# Web Application Security Fundamentals Canonical URL: ## Overview This is an intermediate course that deliberately spans two audiences who usually get trained separately. It carries enough technical grounding for the people who build and configure web applications, and enough plain-language framing for the system owners, security officers and program staff who oversee them without writing code. The shared vocabulary is the point, because a system owner, a security officer and a developer can take this course together and come out able to talk to each other, which is what actually makes security reviews go faster. There is no lab, and that is deliberate: there is no environment to provision and no technical prerequisites, so the course can be assigned to oversight staff and developers at the same time. All interactivity is interactive categorization exercises and scenario prompts of the form "given this situation, what is the most appropriate action," and no lab environment is required for any module or for the final assessment. Every topic is anchored to a real policy and standards landscape rather than taught generically. Module 1 is intentionally policy-heavy so the later technical modules can refer back to it, covering security risk management frameworks and the system-authorization process, a major executive cybersecurity order and its amendments, and the NIST Cybersecurity Framework 2.0, and it teaches something rarely taught at all: how to recognize when a policy has been superseded, and why confirming currency matters before relying on it for compliance — a skill that is rare in commercial training and directly transferable to any regulated environment. Module 2 uses the OWASP Top 10, 2025 edition, as its organizing frame and stays focused on recognizing risk rather than writing exploit code, and from there the course moves through the secure development lifecycle and the Secure Software Development Framework, then identity, access control and data protection including Zero Trust and FIPS-validated encryption, before closing on continuous monitoring, event logging and incident reporting. Assessment is by ungraded quick checks in each module plus a graded final covering all five modules proportionally, weighted toward applying concepts rather than recalling facts, at 70% to pass with unlimited retakes. ## What you'll learn - Explain why web application security is a shared responsibility across technical and non-technical staff - Identify the laws, executive orders and NIST, OMB and CISA guidance that govern how organizations secure their web applications - Recognize when a policy or memorandum has been superseded, and why confirming currency matters - Recognize the most common categories of web application vulnerability and the risk each poses to an organization's systems and data - Describe secure software development lifecycle practices and how they reduce risk - Apply core secure-coding principles including input validation, output encoding, least privilege, secure defaults and failing securely - Manage risk from third-party and open-source components - Explain identity, access control and data protection principles, including Zero Trust and FIPS-validated encryption - Describe best-practice expectations for continuous monitoring, event logging and incident reporting - Apply all of the above to realistic scenarios without needing a technical lab ## Prerequisites Basic familiarity with general cybersecurity concepts and everyday web application use. No development experience required. ## Schedule - Jan 7, 2027 – Jan 8, 2027 — Live Online - Feb 25, 2027 – Feb 26, 2027 — Live Online - Mar 29, 2027 – Mar 30, 2027 — Live Online - Apr 13, 2027 – Apr 14, 2027 — Live Online - May 6, 2027 – May 7, 2027 — Live Online - Jun 29, 2027 – Jun 30, 2027 — Live Online - Jul 12, 2027 – Jul 13, 2027 — Live Online - Aug 5, 2027 – Aug 6, 2027 — Live Online ## Pricing **Tuition:** $899